tongban government policy understanding

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:26 AM UTC
• Version: 1.0.0

Overview

This skill is a Shanghai government-service lookup aid that uses public reference data and optional public-data refresh scripts, with no evidence of hidden collection, persistence, or unsafe authority.

Install only if you want Shanghai municipal service guidance. Treat answers as routing help, not final legal or eligibility advice; verify official pages or 021-12345 before acting, and avoid providing unnecessary personal, medical, legal, or financial details. Be aware the package references a missing service_items.jsonl file, so coverage may be incomplete unless the data is refreshed or supplied.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The code does relate to Shanghai government service-guide data, but its behavior does not match the declared end-user assistant purpose. It does not implement question answering, service-item search, department identification from user needs, or online/offline办事 guidance. Instead, it validates the structure and consistency of pre-generated data files. This is a materially different primary purpose, so it should be flagged as a mismatch.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill enables allow_implicit_invocation without a narrowly defined trigger boundary, so the agent may invoke this skill based on broad semantic matches rather than explicit user intent. In a government-service guidance context, that can cause unintended routing of user queries, unnecessary disclosure of user-provided personal details to the skill, or confusing/incorrect procedural guidance when the user did not actually ask for this capability.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The document title and operational instruction are written entirely in Chinese, and L03 uses mandatory language ('回答时必须提示复核') without offering any language or locale choice. Under the policy, forcing a specific language is a violation unless the locale constraint is explicitly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code generates user-facing Markdown content entirely in Chinese, including headings and usage instructions, with no opt-in or configurable locale. The policy requires flagging language or locale constraints unless the skill offers a choice or the region-specific limitation is clearly documented and justified in the file.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The validator accepts only the literal role values "个人" and "法人", which hard-codes a specific language/locale assumption into the skill behavior. There is no indication that users can opt into this locale constraint or that the restriction is documented as a justified region-specific policy in the file.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: This JSON reference file stores department names and labels only in Chinese, and there is no surrounding natural-language indication that the skill offers a language or locale choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: This markdown file instructs the skill to search and return candidate government services, and the indexed content clearly includes sensitive categories such as health, tax, police, court, disability, and benefits records. The description provides no user-facing warning that handling such requests may surface privacy-sensitive links or require care with personal data.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This JSON reference data is overwhelmingly Chinese-language content, including service names and status notes, with no indication that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language or locale without user choice can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.